| auditpipe.4 (159273) | auditpipe.4 (159282) |
|---|---|
| 1.\" Copyright (c) 2006 Robert N. M. Watson 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. --- 8 unchanged lines hidden (view full) --- 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" | 1.\" Copyright (c) 2006 Robert N. M. Watson 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. --- 8 unchanged lines hidden (view full) --- 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" |
| 25.\" $FreeBSD: head/share/man/man4/auditpipe.4 159273 2006-06-05 15:26:09Z rwatson $ | 25.\" $FreeBSD: head/share/man/man4/auditpipe.4 159282 2006-06-05 16:31:57Z joel $ |
| 26.\" 27.Dd May 5, 2006 28.Os 29.Dt AUDITPIPE 4 30.Sh NAME 31.Nm auditpipe 32.Nd Pseudo-device for live audit event tracking 33.Sh SYNOPSIS 34.Cd "options AUDIT" 35.Sh DESCRIPTION 36While audit trail files 37generated with 38.Xr audit 4 39and maintained by 40.Xr auditd 8 41provide a reliable long-term store for audit log information, current log 42files are owned by the audit daemon until terminated making them somewhat | 26.\" 27.Dd May 5, 2006 28.Os 29.Dt AUDITPIPE 4 30.Sh NAME 31.Nm auditpipe 32.Nd Pseudo-device for live audit event tracking 33.Sh SYNOPSIS 34.Cd "options AUDIT" 35.Sh DESCRIPTION 36While audit trail files 37generated with 38.Xr audit 4 39and maintained by 40.Xr auditd 8 41provide a reliable long-term store for audit log information, current log 42files are owned by the audit daemon until terminated making them somewhat |
| 43unwieldy for live montoring applications such as host-based intrusion | 43unwieldy for live monitoring applications such as host-based intrusion |
| 44detection. 45For example, the log may be cycled and new records written to a new file 46without notice to applications that may be accessing the file. 47.Pp 48The audit facility provides an audit pipe facility for applications requiring 49direct access to live BSM audit data for the purposes of real-time 50monitoring. 51Audit pipes are available via a clonable special device, --- 69 unchanged lines hidden (view full) --- 121.Pp 122Possible preselection mode values are: 123.Bl -tag -width AUDITPIPE_PRESELECT_MODE_TRAIL 124.It AUDITPIPE_PRESELECT_MODE_TRAIL 125Use the global audit trail preselection parameters to select records for the 126audit pipe. 127.It AUDITPIPE_PRESELECT_MODE_LOCAL 128Use local audit pipe preselection; this model is similar to the global audit | 44detection. 45For example, the log may be cycled and new records written to a new file 46without notice to applications that may be accessing the file. 47.Pp 48The audit facility provides an audit pipe facility for applications requiring 49direct access to live BSM audit data for the purposes of real-time 50monitoring. 51Audit pipes are available via a clonable special device, --- 69 unchanged lines hidden (view full) --- 121.Pp 122Possible preselection mode values are: 123.Bl -tag -width AUDITPIPE_PRESELECT_MODE_TRAIL 124.It AUDITPIPE_PRESELECT_MODE_TRAIL 125Use the global audit trail preselection parameters to select records for the 126audit pipe. 127.It AUDITPIPE_PRESELECT_MODE_LOCAL 128Use local audit pipe preselection; this model is similar to the global audit |
| 129trail configuration model, consisting of global flags and naflags paramaters, | 129trail configuration model, consisting of global flags and naflags parameters, |
| 130as well as a set of per-auid masks. 131These parameters are configured using further ioctls. 132.El 133.Pp 134After changing the audit pipe preselection mode, records selected under 135earlier preselection configuration may still be in the audit pipe queue. 136The application may flush the current record queue after changing the 137configuration to remove possibly undesired records. 138.Ss Audit Pipe Local Preselection Mode Ioctls | 130as well as a set of per-auid masks. 131These parameters are configured using further ioctls. 132.El 133.Pp 134After changing the audit pipe preselection mode, records selected under 135earlier preselection configuration may still be in the audit pipe queue. 136The application may flush the current record queue after changing the 137configuration to remove possibly undesired records. 138.Ss Audit Pipe Local Preselection Mode Ioctls |
| 139The following ioctls configure the preselection paramaters used when an audit | 139The following ioctls configure the preselection parameters used when an audit |
| 140pipe is configured for the 141.Dv AUDITPIPE_PRESELECT_MODE_LOCAL 142preselection mode. 143.Bl -tag -width AUDITPIPE_GET_PRESELECT_NAFLAGS 144.It AUDITPIPE_GET_PRESELECT_FLAGS 145Retrieve the current default preselection flags for attributable events on 146the pipe. 147These flags correspond to the --- 102 unchanged lines hidden --- | 140pipe is configured for the 141.Dv AUDITPIPE_PRESELECT_MODE_LOCAL 142preselection mode. 143.Bl -tag -width AUDITPIPE_GET_PRESELECT_NAFLAGS 144.It AUDITPIPE_GET_PRESELECT_FLAGS 145Retrieve the current default preselection flags for attributable events on 146the pipe. 147These flags correspond to the --- 102 unchanged lines hidden --- |